@afokapu/atdd-bun 0.7.0 → 0.7.2

package/README.md

@@ -77,8 +77,15 @@ profiles: [traceability, planner]
 
 `all`, the hooks and the generated CI then run only those profiles. Any profile can still be run
 by name (`bun run atdd-bun coder`) to see what remains. An unknown name or an empty list is an
-error, never a silent run of nothing. Removing a profile loosens `atdd-bun.yaml`, so the integrity
-check reports it against the base branch until a human approves the change.
+error, never a silent run of nothing.
+
+With no `profiles:` field, every profile runs, but none is governed yet. The first explicit list is
+the adoption that establishes the governed set, so a brownfield repository can declare
+`profiles: [docs]` in an ordinary pull request. From then on, the integrity check reports, against
+the base branch, removing a profile from the list and removing the list itself. The second closes
+the two-step bypass `[docs, security]` → no list → `[docs]`. `init` writes a new `atdd-bun.yaml`
+with every profile listed, so a greenfield repository is governed from its first commit; trim the
+list before that commit to adopt gradually.
 
 ## Configuration
 
@@ -116,7 +123,8 @@ modify the toolkit itself, only the configuration it offers, and enable capabili
 - the installed package differs from its published hashes;
 - the dependency is not an npm registry version;
 - a generated file (workflow, skills, instruction block, integrity test) was edited;
-- `atdd-bun.yaml` is looser than on the base branch.
+- `atdd-bun.yaml` is looser than on the base branch (after the first explicit `profiles:` list,
+  dropping a profile or the list counts).
 
 Each finding names its restore command.
 

package/integrity.json

@@ -1,9 +1,9 @@
 {
-  "version": "0.7.0",
+  "version": "0.7.2",
   "files": {
     "HOOK_AUDIT.md": "5329d840db37671b1918f688ead26865473b87db73dbc75f7c8b2a8bbe8d6d43",
     "PLANNER_PORT.md": "fb5935bac8b7ac18994de21e43ace3a5ef8cd55f85b0e3349fca261280054f11",
-    "README.md": "32ef74f2a1f29f709638ff08c21d247e00761b62ae056883dc701e4a4d51a518",
+    "README.md": "4e612f6344fab29c38269ce0303b73c32f75911dfef16a3acefe382f068329a3",
     "bunfig.toml": "b9fc65eca9014c5179380259d70e76385a6a80788fa9a2df5fb3eaa5554fd2fe",
     "conventions/atdd-bun.planner/atdd-bun.planner.acceptance-identity.convention.yaml": "81c5c773d5ee15e8d99a2c237aa9846b110b2533df45ebf407d0e3ec6ed3dd03",
     "conventions/atdd-bun.planner/atdd-bun.planner.identity-required.convention.yaml": "e96d7c1455d0c221072d82e7f2b55da1c4f9ceb17718eb6ed96affdeef37675b",
@@ -1175,20 +1175,20 @@
     "src/enforce.ts": "d7232331c9f0fdd150f2ca4bbf1bd2e877de111c684d46b690fd7acdae59f39c",
     "src/hooks.ts": "adbb72f7a83f53d596fd217f01f4ce32c5a59a23ab81993fed226fb96fd1cbd1",
     "src/index.ts": "b3cc97f9867bd605aefa95650a6b8b773e32e6e52e58792d0dbf6736dd3406be",
-    "src/integrity.ts": "009b5f23ec3240cdc2cb133f942995e48f494edaa0259053bca15283134be3ea",
+    "src/integrity.ts": "c1ef78d93f418f50b15178de939c21e480ed49420c003d75e1c344ecbb95ce5b",
     "src/journey-docs.ts": "994d229376244c84212cff951032823068a76565dd2fd427b9d44e341bd14853",
     "src/planner-kernel.ts": "5d3f5305fb59becb2cc97d8a03aca6b104f385805d91cc0410856e289dd6fbb1",
     "src/planner-schema-validator.ts": "ce529c0936171075e93c7539b3655fe895a98dd2973ebda5775958e6ebc316d9",
     "src/planner-validators.ts": "99adeb65f579af923c11f21a8f55cfb9993b007fd8df59c5f764696b55379cfc",
     "src/register.ts": "6a2f1c6b8df0dc9c8f45df8ec9fac2be29044e048b08c8ffe423410e94dadedd",
     "src/release.ts": "7b0fe444ee81f476f53b9c21b6c347ef588ee616c60211419cf984132be768ba",
-    "src/setup.ts": "0a6f1a9aeff31dcf17f6bd036168b909c1841c11bbbb452105d8debf64a6bc78",
+    "src/setup.ts": "8e69ffc4f49ad7240243728db3c0c495d2c4d66f04652cd735a0a90c79ca4246",
     "src/telemetry-plan.ts": "cdb1e8bfff414f3ea81977388973da2cf6d89567d9e060dc9d5989a33600f153",
     "src/topology.ts": "9779ee48e1c453abb76363163d4ab363463fa14e359571139f6d1f1fcc51ae2c",
     "templates/agents/AGENTS.block.md": "c45d831e57976b874d2a6dc6e5e929b6e9ea3f928fe8c6683c2bab71676817c7",
     "templates/agents/atdd-bun.integrity.test.ts": "dec6f6e5f65a08d9512fc703b367c163f8c9da1f6aa7fd466835c1ec30348a41",
     "templates/agents/atdd/SKILL.md": "b621abe22851a75b30fc0e6c339a2c0a3ed6bbf78b8c17000a4ce301e05df96d",
     "templates/github/atdd-bun-release.yml": "d9547e9e6ef3ae010d53d55314f6a54567f88bd900f7e50d994cd308601d2684",
-    "templates/github/atdd-bun.yml": "12b2e23863b64197e0f2f6f2976fdb5cb06f79662122542bf8d2f7ad41337be9"
+    "templates/github/atdd-bun.yml": "b54fe01661e7141ae70b6db881a4870c4a09c11b1be29ed8364ace35dc4e0564"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@afokapu/atdd-bun",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/afokapu/atdd-bun.git"

package/src/integrity.ts

@@ -2,7 +2,6 @@ import { existsSync } from "node:fs";
 import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { instructionPaths } from "./agent";
-import { concreteProfiles } from "./enforce";
 import { defaultHookPolicy, type HookPolicy } from "./hooks";
 
 /**
@@ -106,6 +105,10 @@ async function checkGenerated(root: string, packageRoot: string): Promise<Integr
   return findings;
 }
 
+/** The operator's explicit profile list, or null when atdd-bun.yaml declares none. Deliberately not enabledProfiles():
+ * its absent-means-all default is right for execution and wrong for deciding whether a policy was ever declared. */
+const explicitProfiles = (config: { profiles?: unknown }): string[] | null => Array.isArray(config.profiles) ? config.profiles.map(String) : null;
+
 /** Names of the policy fields in `current` that are looser than in `base`. */
 export function loosenedPolicy(base: Partial<HookPolicy> & { profiles?: unknown }, current: Partial<HookPolicy> & { profiles?: unknown }): string[] {
   const b = { ...defaultHookPolicy, ...base, worktrees: { ...defaultHookPolicy.worktrees, ...base.worktrees } }, c = { ...defaultHookPolicy, ...current, worktrees: { ...defaultHookPolicy.worktrees, ...current.worktrees } };
@@ -116,20 +119,41 @@ export function loosenedPolicy(base: Partial<HookPolicy> & { profiles?: unknown
   const removed = b.protected_branches.filter(x => !c.protected_branches.includes(x)), added = c.registry_paths.filter(x => !b.registry_paths.includes(x));
   if (removed.length) out.push(`protected_branches drops ${removed.join(", ")}`);
   if (added.length) out.push(`registry_paths adds ${added.join(", ")}`);
-  // Deactivating a profile stops enforcing it; the operator may do it, as a change a human approves.
-  const active = (config: { profiles?: unknown }): string[] => Array.isArray(config.profiles) ? config.profiles.map(String) : concreteProfiles;
-  const dropped = active(base).filter(name => !active(current).includes(name));
+  // Profiles: an absent list runs every profile (enabledProfiles) but governs none. The first explicit list is the
+  // adoption that establishes the governed set, not a drop. From then on, dropping a profile or removing the list
+  // (explicit → implicit → narrower would otherwise be a two-step bypass) is loosening a human approves.
+  const before = explicitProfiles(base), after = explicitProfiles(current);
+  if (before && !after) out.push(`profiles becomes implicit: the explicit list [${before.join(", ")}] was removed`);
+  const dropped = before && after ? before.filter(name => !after.includes(name)) : [];
   if (dropped.length) out.push(`profiles drops ${dropped.join(", ")}`);
   return out;
 }
 
 /** atdd-bun.yaml is not looser than on the branch being merged into. */
+/** How to recover a baseline that cannot be resolved. A replaced tip is reachable from no branch, so only a fetch by its
+ * full object id brings it back (SHA-1 or SHA-256, any case); an abbreviated id cannot be fetched; a ref name can. */
+export function baselineRestore(ref: string): string {
+  if (/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(ref)) return `git fetch origin ${ref}, then re-run the check (a replaced tip is reachable from no branch, so a plain fetch does not bring it)`;
+  if (/^[0-9a-f]{4,63}$/i.test(ref)) return `set ATDD_BASE_REF to the full SHA of ${ref} (an abbreviated SHA cannot be fetched), fetch it with git fetch origin <full SHA>, then re-run the check`;
+  return `git fetch origin, then re-run the check`;
+}
+
 async function checkPolicy(root: string, base?: string, push = process.env.GITHUB_EVENT_NAME === "push"): Promise<IntegrityFinding[]> {
-  const ref = base ?? process.env.ATDD_BASE_REF ?? (process.env.GITHUB_BASE_REF ? `origin/${process.env.GITHUB_BASE_REF}` : "origin/HEAD");
-  if ((await git(root, ["rev-parse", "--verify", "--quiet", ref])).code) return [];
-  let against = (await git(root, ["merge-base", "HEAD", ref])).out;
-  // A CI push to the base branch has nothing to merge into: judge the pushed commit against its parent.
-  if (push && against === (await git(root, ["rev-parse", "HEAD"])).out) against = (await git(root, ["rev-parse", "--verify", "--quiet", "HEAD~1"])).out;
+  // On a push, the generated CI passes the pre-push tip (github.event.before) as ATDD_BASE_REF, so a multi-commit push
+  // is judged as a whole: [docs, security] → no list → [docs] in one push cannot read as a first adoption.
+  const ref = base || process.env.ATDD_BASE_REF || (process.env.GITHUB_BASE_REF ? `origin/${process.env.GITHUB_BASE_REF}` : "origin/HEAD");
+  const newBranch = /^0+$/.test(ref), resolved = newBranch ? "" : (await git(root, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`])).out;
+  let against: string;
+  // An explicit baseline (the pre-push tip, the merge queue's target) that cannot be resolved fails closed.
+  if (!newBranch && !resolved && (base || process.env.ATDD_BASE_REF)) return [{ file: "atdd-bun.yaml", detail: `cannot resolve the policy baseline ${ref} to judge this change against`, restore: baselineRestore(ref) }];
+  if (push) {
+    // A push is judged against the tip it replaced, directly, never a merge base: after a force push the merge base
+    // can predate the policy being removed. A new branch has no previous tip and is judged against its parent.
+    against = resolved && resolved !== (await git(root, ["rev-parse", "HEAD"])).out ? resolved : (await git(root, ["rev-parse", "--verify", "--quiet", "HEAD~1"])).out;
+  } else {
+    if (!resolved) return [];
+    against = (await git(root, ["merge-base", "HEAD", ref])).out;
+  }
   if (!against) return [];
   const read = async (text: string | null) => (text ? Bun.YAML.parse(text) ?? {} : {}) as Partial<HookPolicy>;
   const before = await git(root, ["show", `${against}:atdd-bun.yaml`]), path = join(root, "atdd-bun.yaml");

package/src/setup.ts

@@ -2,6 +2,21 @@ import { ciInit, ciStatus } from "./ci";
 import { hooksStatus, installHooks } from "./hooks";
 import { agentInit, agentStatus } from "./agent";
 import { integrityInit, integrityStatus } from "./integrity";
+import { concreteProfiles } from "./enforce";
+import { existsSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+/** A new atdd-bun.yaml declares every profile explicitly. An absent list runs every profile but governs none, so
+ * without this a greenfield repository's first `profiles:` line could switch most of them off unreported. A
+ * brownfield repository trims the list before its first commit; after that, dropping one is a reported loosening.
+ * An existing atdd-bun.yaml is never touched. */
+export async function policyInit(root = process.cwd()) {
+  const file = join(root, "atdd-bun.yaml");
+  if (existsSync(file)) return { ok: true, message: `${file} kept` };
+  await writeFile(file, `# Generated by atdd-bun init. The profiles this repository enforces; trim the list before the first commit to\n# adopt gradually. Once committed, removing a profile or the list is reported by the integrity check.\nprofiles: [${concreteProfiles.join(", ")}]\n`);
+  return { ok: true, message: file };
+}
 
 /** Install the package's opt-in local surfaces without touching unrelated
  * workflows or hook paths. Dependency installation itself never calls this. */
@@ -21,5 +36,6 @@ export async function initializeRepository(root = process.cwd(), replace = false
   const existingIntegrity = await integrityStatus(root);
   const integrity = replace || !existingIntegrity.ok ? await integrityInit(root, replace) : existingIntegrity;
   if (!integrity.ok) return { ok: false, message: `integrity test: ${integrity.message}` };
-  return { ok: true, message: `hooks: ${hooks.message}\nCI workflow: ${ci.message}\nagent skill: ${agent.message}\nintegrity test: ${integrity.message}` };
+  const policy = await policyInit(root);
+  return { ok: true, message: `hooks: ${hooks.message}\nCI workflow: ${ci.message}\nagent skill: ${agent.message}\nintegrity test: ${integrity.message}\npolicy: ${policy.message}` };
 }

package/templates/github/atdd-bun.yml

@@ -9,6 +9,11 @@ jobs:
   atdd-bun:
     name: atdd-bun
     runs-on: ubuntu-latest
+    env:
+      # The policy baseline for every step (the integrity step and the generated integrity test alike): on a push, the
+      # pre-push tip, so a multi-commit push is judged as a whole; in the merge queue, the queue's target (GitHub sets
+      # no GITHUB_BASE_REF there); on a pull request, GITHUB_BASE_REF.
+      ATDD_BASE_REF: ${{ github.event_name == 'push' && github.event.before || github.event_name == 'merge_group' && github.event.merge_group.base_sha || '' }}
     steps:
       - uses: actions/checkout@v4
         with: { fetch-depth: 0 }